Retain multiple SrcFile and identity evidences

Signed-off-by: Prabhu Subramanian <[email protected]>

lib/cli/index.js

@@ -918,8 +918,22 @@ function addComponent(
         pkg.evidence.identity &&
         !Array.isArray(pkg.evidence.identity)
       ) {
+        // Automatically add concludedValue
+        if (pkg.evidence.identity?.methods?.length === 1) {
+          pkg.evidence.identity.concludedValue =
+            pkg.evidence.identity.methods[0].value;
+        }
         component.evidence.identity = [pkg.evidence.identity];
       }
+      // Convert evidence.identity section to an object for 1.5
+      if (
+        options.specVersion === 1.5 &&
+        pkg.evidence &&
+        pkg.evidence.identity &&
+        Array.isArray(pkg.evidence.identity)
+      ) {
+        component.evidence.identity = pkg.evidence.identity[0];
+      }
     }
     // Upgrade authors section
     if (options.specVersion >= 1.6 && component.author) {
@@ -4947,6 +4961,7 @@ export function createPHPBom(path, options) {
       const retMap = parseComposerLock(f, rootRequires);
       if (retMap.pkgList?.length) {
         pkgList = pkgList.concat(retMap.pkgList);
+        pkgList = trimComponents(pkgList);
       }
       if (retMap.dependenciesList) {
         if (moduleParent?.["bom-ref"]) {
@@ -5598,6 +5613,43 @@ export function trimComponents(components) {
           existingComponent.properties = comp.properties;
         }
       }
+      // Retain all component.evidence.identity
+      if (comp?.evidence?.identity) {
+        if (!existingComponent.evidence) {
+          existingComponent.evidence = { identity: [] };
+        } else if (
+          existingComponent?.evidence?.identity &&
+          !Array.isArray(existingComponent.evidence.identity)
+        ) {
+          existingComponent.evidence.identity = [
+            existingComponent.evidence.identity,
+          ];
+        }
+        // comp.evidence.identity can be an array or object
+        // Merge the evidence.identity based on methods or objects
+        const identities = Array.isArray(comp.evidence.identity)
+          ? comp.evidence.identity
+          : [comp.evidence.identity];
+        for (const aident of identities) {
+          let methodBasedMerge = false;
+          if (aident?.methods?.length) {
+            for (const amethod of aident.methods) {
+              for (const existIdent of existingComponent.evidence.identity) {
+                if (existIdent.field === aident.field) {
+                  if (!existIdent.methods) {
+                    existIdent.methods = [];
+                  }
+                  existIdent.methods.push(amethod);
+                  methodBasedMerge = true;
+                }
+              }
+            }
+          }
+          if (!methodBasedMerge && aident.field && aident.confidence) {
+            existingComponent.evidence.identity.push(aident);
+          }
+        }
+      }
       // If the component is required in any of the child projects, then make it required
       if (
         existingComponent?.scope !== "required" &&